What is the CVSS score of CVE-2026-34708?

CVE-2026-34708 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe InCopy are affected by CVE-2026-34708?

Adobe InCopy versions 21.3 and earlier contain a stack-based buffer overflow vulnerability that enables arbitrary code execution when users open maliciously crafted documents.

How to fix or mitigate CVE-2026-34708?

Within 24 hours: Identify and inventory all systems running Adobe InCopy 21.3, 20.5.3, or earlier. Within 7 days: Implement document source validation policies restricting opening of unsolicited external files; conduct user training on document handling risks. Within 30 days: Contact Adobe for patching timeline; if patch unavailable, establish technical controls (air-gapping sensitive InCopy systems, disabling auto-load features, evaluating alternative document tools).

Adobe InCopy CVE-2026-34708

EUVD-2026-35785 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 adobe

GHSA-xvhc-r5q4-hcgj

RCE Buffer Overflow Stack Overflow Adobe Incopy

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:53 vuln.today

DescriptionCVE.org

InCopy versions 21.3, 20.5.3 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Stack-based buffer overflow in Adobe InCopy 21.3, 20.5.3 and earlier enables arbitrary code execution in the context of the logged-in user when a victim opens a maliciously crafted document. The flaw is locally exploitable via file-format parsing and requires user interaction, with no public exploit identified at time of analysis. CVSS 7.8 reflects high impact on confidentiality, integrity, and availability but constrained reachability through the document-open vector.

Technical ContextAI

Adobe InCopy is a professional copywriting and editing application tightly integrated with InDesign, sharing many of the same file-format parsers (ICML, INCX, INDD-linked content). The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), meaning a fixed-size stack buffer is written past its bounds during parsing of attacker-controlled data inside a document. Successful overflow can corrupt the saved return address or adjacent stack frames, redirecting control flow into attacker-supplied shellcode or ROP gadgets. The CPE cpe:2.3:a:adobe:incopy:*:*:*:*:*:*:*:* indicates all builds up to and including 21.3 and 20.5.3 across supported platforms are in scope.

RemediationAI

Apply the vendor-released patches referenced in Adobe Security Bulletin APSB26-59 (https://helpx.adobe.com/security/products/incopy/apsb26-59.html) - upgrade InCopy 21.x to the fixed release listed in that bulletin and the 20.x branch to a version newer than 20.5.3. Where immediate patching is not possible, restrict opening of InCopy files (.icml, .incx, .indd) received from untrusted sources, route external documents through a sandboxed previewing workstation or detonation environment, and consider blocking these file types at email and web gateways for non-creative users; the trade-off is friction for legitimate collaboration with external editors and agencies. Application allowlisting and exploit-mitigation tooling (Windows Defender Exploit Guard, macOS hardened runtime/Gatekeeper) can reduce success probability against the stack overflow but should not be relied on as a substitute for the patch.